176.31.139.17📋 Copy

## IP Intelligence Briefing: 176.31.139.17

Classification: Moderate Risk Infrastructure | Report Date: 2026-06-15

---

Executive Summary

IP 176.31.139.17 is a cloud-based infrastructure address operated by OVH in Roubaix, France, associated with the ahrefs.net domain. The IP exhibits moderate risk (score: 40) within a high-abuse density subnet (176.31.139.0/24), where 28 of 32 sibling IPs show threat activity. No active threat indicators were detected at the time of analysis.

---

Network & Ownership Profile

---

DNS Resolution & Hostname Mapping

• Primary Hostname: proxy-fr004-san17.ahrefs.net
• Domain: ahrefs.net
• PTR Record: Forward resolution confirmed
• DNSSEC: Valid
• CAA Records: Present (1 issuer)

---

Threat Indicators & Reputation

---

Neighborhood Analysis: 176.31.139.0/24

The /24 subnet exhibits elevated abuse characteristics:

• Total Sibling IPs: 32
• Active Siblings: 6
• Threat Siblings: 28 (87.5% of active neighbors)
• Abuse Density: 0.875 (High)
• Inherited Risk: 35
• Neighbor Risk Distribution: 0 High, 31 Medium, 0 Low

Neighbor IPs show risk scores ranging from 35-50, indicating systemic risk within the subnet infrastructure.

---

Temporal History

Analysis of 18 observations indicates consistent risk posture with no significant degradation or escalation:

• Abuse Density: Consistently 0.875 (High)
• Classification: Stable "high_abuse" designation
• Network Role: Persistent CloudCompute classification
• DNS Associations: Stable ahrefs.net hostname resolution

---

Recommended Security Actions

Given the moderate risk profile and high-abuse neighborhood context, consider the following controls:

---

Intelligence Assessment

The IP represents legitimate cloud infrastructure for Ahrefs, but operates within a high-abuse subnet where 87.5% of active neighbors demonstrate threat indicators. The moderate risk score (40) combined with the subnet-level abuse density suggests potential shared infrastructure risk. While no direct threat activity was observed on this specific IP, the neighborhood context warrants monitoring for anomalous behavior, particularly given the high concentration of threat-sibling IPs in the /24.

Priority Level: Medium - Monitor for behavioral anomalies or subnet-wide campaigns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.